dsh-workspace-hygiene

Configuration

The inserted row enables bounded idle scans and catalog synchronization with safe mutation defaults. It does not set managedRoots, so the default scope is the whole workspace subject to the protected-path rules; autonomousMode and autoArchive remain off. For a shared repository, override the complete row in your profile's cordis.patch.yml and set a narrow managedRoots list:

- id: workspace-hygiene
  name: dsh-workspace-hygiene
  config:
    enabled: true
    catalogEnabled: true
    catalogRoot: workspace-artifacts
    # Keep inspection narrow. These are workspace-relative.
    managedRoots:
      - .dsh/ephemeral
      - .dsh/tmp
      - tmp
      - scratch
      - outputs/.staging
    minAgeHours: 24
    maxScanFiles: 5000
    maxArchiveFiles: 20
    maxArchiveBytes: 104857600
    autoScan: true
    autoArchive: false
    autonomousMode: false
    notifyAgent: false
    # Relative means inside the workspace root (not the state directory).
    stateDir: .dsh-hygiene
    # Prefer an external location for long-lived quarantine data.
    archiveRoot: ~/.dsh/workspace-hygiene-archive

This replaces the bundle's existing workspace-hygiene row by id. Use - insert: only when adding a new, differently named row; inserting the same id would create a duplicate loader entry.

Important safety knobs:

• managedRoots narrows the scan. An omitted list scans the workspace subject to the protected-path rules; for a shared repository, set it explicitly to a small list such as .dsh/ephemeral, .dsh/tmp, tmp, and scratch.
• An explicitly listed managed root may live under a normally protected hidden/configuration directory (for example .dsh/ephemeral); repository metadata, dependency trees, and .env* names remain non-overridable.
• minAgeHours prevents a file that was just produced by the current turn from being selected.
• maxArchiveFiles and maxArchiveBytes bound one apply operation.
• Built-in credential/key/certificate protections cannot be removed by replacing protectedNames or protectedExtensions; those options only add project- specific rules.
• .hygieneignore contains simple path/glob exclusions; a trailing / covers a directory and its descendants. Negation patterns are intentionally unsupported. The file must be a regular file inside the workspace and is capped at 256 KiB; symlinks and oversized files fail closed. Reports expose only a bounded prefix of the pattern list.
• Keep allowPathOverride false unless an operator deliberately wants model calls to select a different workspace; enabling it removes the session-root boundary and should be paired with an isolated profile.
• allowHiddenCandidates only relaxes the hidden-name guard; hard-protected metadata, dependency, .env*, and built-in protected names remain protected.
• Relative archiveRoot values stay inside the workspace; use an absolute path or ~ when an external archive is intentional. It must not be the workspace itself, an ancestor that contains the workspace, or a directory nested inside a managed root; these layouts would overlap the source tree and are rejected. Quarantine records include source, destination, size, hash, timestamp, and status. Catalog entries only contain metadata and handling recommendations; source files are never copied into workspace-artifacts/.
• autonomousMode is the full-autonomy switch and is off by default. When enabled, idle maintenance may execute eligible archive/delete decisions without a per-run confirmation. Autonomous physical organization additionally requires valuePolicy.organization.moveFiles: true. Hard protections, managed roots, age/file/byte budgets, and fingerprint checks still apply. Use it only in an isolated profile after observing manual plans.
• autoScan controls periodic catalog refresh and does not by itself move or delete source files.
• autoArchive is a legacy idle-maintenance switch for automatically quarantining selected archive/delete recommendations. It is off by default, does not enable autonomousMode, and does not perform physical source organization.
• catalogEnabled controls persistence of the metadata catalog; catalogRoot selects its workspace-relative root (default workspace-artifacts). If the top-level value is omitted, valuePolicy.organization.root can select the root (the organization root is the catalog namespace, not a source-file destination). retainDirectory, archiveDirectory, reviewDirectory, and deleteDirectory name catalog groups, not mandatory physical destinations for source files. The catalog root must not overlap the state or archive roots.
• valuePolicy.organization.moveFiles controls whether accepted organization suggestions become physical moves/renames during autonomous idle maintenance; it is off by default. A reviewed, explicit apply --organize request may still perform a move after confirmation even when this flag is false. fileRoot can set a workspace-relative physical organization root. Protected paths and symlink boundaries still win.